Trust Oracle is answering right now. Last checked 15 min ago. It exposes 3 tools. Last commit 27 Oct 2026.
Independent A-F trust grade for any MCP server, watched for drift. Free, never for sale.
What the code does
We read the source, 6 d ago · tools taken from the live server · rules 995398eba69f
Things with no honest explanation: a promise that contradicts the code, code that runs at install time while hiding what it does, data leaving the machine.
… "@modelcontextprotocol/server-slack"],\n "env": {\n "SLACK_BOT_TOKEN": "xoxb-your-plaintext-token"\n }\n }\n }\n}\n</code></pre>\n<p>This works for a developer's local machine, but it is a security disaster for mul…
What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.
"iVBORw0KGgoAAAANSUhEUgAABLAAAAJ2CAIAAADAIuwLAAAQAElEQVR4nNz9e+x/X5cfBK31/s6l7UxmbJspzzCd55k6oNQBajuUKnVmFNPERqLGpDHaCCSE/xq8xGBqrJdgFFNMNVDBag1GE+IlGq2j+EeNfxhRsUJhgITAcL+00LRTWqAP/ZzF9733urzW2mufc96fz/f3e55wft+s3/qc9z5r771u+7LOOvt7vvWNnyMmEiJmEhkQUfuR5pX/6q++jNNMdb2Dzq49jlbY1…
"iVBORw0KGgoAAAANSUhEUgAABLAAAAJ2CAIAAADAIuwLAAAQAElEQVR4nNz9e+x/X5cfBK31/s6l7UxmbJspzzCd55k6oNQBajuUKnVmFNPERqLGpDHaCCSE/xq8xGBqrJdgFFNMNVDBag1GE+IlGq2j+EeNfxhRsUJhgITAcL+00LRTWqAP/ZzF9733urzW2mufc96fz/f3e55wft+s3/qc9z5r771u+7LOOvt7vvWNnyMmEiJmEhkQUfuR5pX/6q++jNNMdb2Dzq49jlbY1…
const SECRET = /~\/\.ssh|id_rsa|\/etc\/passwd|\bAWS_SECRET|\.env\b|\.cursor\/mcp\.json|private[_ ]?key/i;
Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.
We found things in this code
Code changes quietly between releases, and nobody reads the diff of a dependency. We do, on every release — watch Trust Oracle and you get told the day something new turns up.
Connect this server
Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 15 min ago.
claude mcp add trust-oracle --transport http https://wmcp.sh/mcp/trusthttps://wmcp.sh/mcp/trust[mcp_servers.trust-oracle]
url = "https://wmcp.sh/mcp/trust"{
"mcpServers": {
"trust-oracle": {
"url": "https://wmcp.sh/mcp/trust"
}
}
}{
"servers": {
"trust-oracle": {
"type": "http",
"url": "https://wmcp.sh/mcp/trust"
}
}
}Available tools 3
Read directly from the server with tools/list, grouped by what they act on.
If a tool disappears, we record the date.
grade_mcp_server
check_mcp_drift
verify_before_execute
Endpoints
| URL | Transport | State | Latency | Checked |
|---|---|---|---|---|
| https://wmcp.sh/mcp/trust | streamable-http | answering | 394 ms | 15 min ago |
Alternatives to Trust Oracle
same job, measured the same wayTrust grades for MCP servers and APIs — scan, grade, and pin capability drift.
Independent trust scores, tool surfaces and change history for MCP servers.
Security grades (A-F) for MCP servers. Check one before you install or trust it. mcpgrade.dev
Check the danger grade of any public MCP server before you connect.
An MCP server for mcp-server-fear-greed
Independent security review for AI-built apps. Watch a GitHub repo. Never a patch.
Does an MCP server work for a stock client? By registry name or URL. Tool drift too. Free, no key.
CLI and MCP server for Gradient MSP Synthesize: usage push, billing drift, alert tracing.
Trust Oracle — questions
Answers built from our own checks of this server.